* [dm-crypt] luksSuspend for plain dm-crypt
@ 2017-08-29 9:37 dm-crypt
2017-08-29 10:19 ` Milan Broz
0 siblings, 1 reply; 4+ messages in thread
From: dm-crypt @ 2017-08-29 9:37 UTC (permalink / raw
To: dm-crypt@saout.de
Hello,
I'd like to emulate the functionality of luksSuspend for a plain
dm-crypt device. I've got lost in the device mapper functions and it
would be great if somebody can give me a hand.
--
cheers
wof
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] luksSuspend for plain dm-crypt
2017-08-29 9:37 [dm-crypt] luksSuspend for plain dm-crypt dm-crypt
@ 2017-08-29 10:19 ` Milan Broz
2017-08-29 12:42 ` dm-crypt
0 siblings, 1 reply; 4+ messages in thread
From: Milan Broz @ 2017-08-29 10:19 UTC (permalink / raw
To: dm-crypt, dm-crypt@saout.de
On 08/29/2017 11:37 AM, dm-crypt@stachelkaktus.net wrote:
> I'd like to emulate the functionality of luksSuspend for a plain
> dm-crypt device. I've got lost in the device mapper functions and it
> would be great if somebody can give me a hand.
Hi,
it is quite easy with dmsetup, but unlike LUKS, there is not a way how
you can check that reinstated key is correct (you can resume target with different
key and cause severe data corruption - that's why we do not support it in cryptsetup).
So, if you want to suspend plan dm-crypt device with name "test"
- You need volume key, you can get it from kernel for active device
# dmsetup table test --showkeys | cut -d' ' -f 5
- Suspend and wipe key is two-step process now:
# dmsetup suspend test
# dmsetup message test 0 key wipe
Now you have suspended device with key(s) wiped from memory (like luksSuspend).
Reinstating the key can be done in reverse:
# dmsetup message test 0 key set <volume key in hex format from command above>
# dmsetup resume test
(This is equivalent of luksResume.)
The message command is not accepted if the device is not suspended.
(Suspended means that all IO operations are queued - beware suspending device
you run command from, it will cause deadlock!)
Note that in future we will optionally support activation through kernel keyring,
so you will put key there, not to dmsetup.
Milan
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] luksSuspend for plain dm-crypt
2017-08-29 10:19 ` Milan Broz
@ 2017-08-29 12:42 ` dm-crypt
2017-08-29 13:17 ` Milan Broz
0 siblings, 1 reply; 4+ messages in thread
From: dm-crypt @ 2017-08-29 12:42 UTC (permalink / raw
To: dm-crypt
Hello Milan,
thanks a lot, that helps.
> it is quite easy with dmsetup, but unlike LUKS, there is not a way how
> you can check that reinstated key is correct (you can resume target with different
> key and cause severe data corruption - that's why we do not support it in cryptsetup).
Ok, I can understand that problem. I will fix it in my script with a
compare to SHA-256(key) that I will store on the ramdisk. Only if the
key matches the script will continue.
> Note that in future we will optionally support activation through kernel keyring,
> so you will put key there, not to dmsetup.
That sounds interesting, but I'm not sure if it will help. I try to kill
the erase the key before I suspend on ram so that cold boot attack don't
work here. If its in the kernel keyring It should be still possible to
find it in the memory. Or have I misread that keyring conzept?
--
cheers
wof
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [dm-crypt] luksSuspend for plain dm-crypt
2017-08-29 12:42 ` dm-crypt
@ 2017-08-29 13:17 ` Milan Broz
0 siblings, 0 replies; 4+ messages in thread
From: Milan Broz @ 2017-08-29 13:17 UTC (permalink / raw
To: dm-crypt, dm-crypt
On 08/29/2017 02:42 PM, dm-crypt@stachelkaktus.net wrote:
>
> That sounds interesting, but I'm not sure if it will help. I try to kill
> the erase the key before I suspend on ram so that cold boot attack don't
> work here. If its in the kernel keyring It should be still possible to
> find it in the memory. Or have I misread that keyring conzept?
Yes, you are correct.
For this key (volume key) it can be wiped after dm-crypt device
is activated, the reaon to use keyring is that the key is no longer included
in dm-ioctl and dm-crypt no longer need to keep the key in its internal structures.
Now during dm-crypt device lifetime (except luksSuspend) the key is in memory
in several places: dm-crypt struct and then in crypto API engine - usually multiple
times (per CPU, depends on crypto module implementation).
Dm-crypt wipe command should wipe all these keys.
Milan
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-08-29 13:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-08-29 9:37 [dm-crypt] luksSuspend for plain dm-crypt dm-crypt
2017-08-29 10:19 ` Milan Broz
2017-08-29 12:42 ` dm-crypt
2017-08-29 13:17 ` Milan Broz
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.